Permit multiple arguments for the nonnull attribute.

This is very useful for non-trivial functions and doesn't
affect existing uses.

MFC after: 5 days